fix: add bounds checking to substr for negative/out-of-range start

[cs01]

Summary

• substr() with negative start index (e.g. "hello".substr(-3)) now correctly wraps around instead of reading out-of-bounds memory
• Start indices beyond string length now return empty string instead of accessing invalid memory
• Same clamping pattern as slice() — handles negative, too-small, and too-large indices

Test plan

• New substr-bounds.ts fixture covering: basic, negative start, very negative, past end, mid, length too long
• npm run verify:quick passes (tests + self-hosting)

🤖 Generated with Claude Code